aegis-desktop 1.0.8 → 1.0.10

package/README.md

@@ -13,7 +13,7 @@ Prebuilt binaries (AppImage / MSI+NSIS / dmg) ship with each release, and the
 package is on npm:
 
 ```bash
-npm install -g aegis-desktop     # requires Node 18+
+npm install -g aegis-desktop     # requires Node 22+
 aegis                            # launch
 ```
 

package/lib/local/autonomous.js

@@ -209,8 +209,15 @@ const DEFAULT_MODEL = 'nexus-brain';
  *     depends on what the user's own daemon happens to have. Both REQUIRE an
  *     explicit model, refused by name instead of silently resolving to
  *     something nobody chose.
+ *   - 'pro' DOES have a default, but not one this app chooses: a blank model
+ *     means "the `claude` CLI picks for the subscription", which is what
+ *     `--model` omitted says (engine.js sends no flag for `default`). Once a
+ *     model IS stated it must be one of claude-pro.js's PRO_MODELS aliases —
+ *     the same list the model picker offers — because the child accepts only
+ *     those four spellings, and a `provider:model` id copied from a byok task
+ *     would otherwise be handed to `claude --model` and fail there.
  */
-const MODEL_CLASSES = Object.freeze(['aegis', 'byok', 'local']);
+const MODEL_CLASSES = Object.freeze(['aegis', 'byok', 'local', 'pro']);
 
 const AEGIS_MODEL_RE = /^(?:nexus|aegis)-brain(?:-(?:smart|neo))?$/;
 const AEGIS_MODEL_IDS = Object.freeze(['nexus-brain', 'aegis-brain']);
@@ -270,6 +277,34 @@ function modelRefusal(id, cls) {
     }
     return '';
   }
+  if (normalized === 'pro') {
+    // The subscription route. A blank model is legal and meaningful: engine.js
+    // sends no `--model` at all for 'default', so the child resolves the pick
+    // itself. Anything STATED must be a PRO_MODELS alias, because those four
+    // spellings are exactly what `claude --model` accepts — a byok-style
+    // "provider:model" copied between tasks would be handed to the child and
+    // fail there, three stages into a drain, with the queue's own file naming
+    // something the queue never validated.
+    if (!stated) return '';
+    // Required lazily: claude-pro.js is a heavy sibling (child spawn, session
+    // files) and this module is loaded by queue.js at every CLI start. The
+    // require is a plain sibling path with no back-require, so there is no
+    // cycle to guard — this is about load cost, not correctness.
+    let aliases;
+    try {
+      aliases = require('./claude-pro.js').PRO_MODELS;
+    } catch {
+      // If the alias list cannot be read we cannot validate a stated model, and
+      // accepting it unvalidated is the exact failure this arm exists to stop.
+      return `a pro task's model cannot be checked right now — queue it with no --model to let the claude CLI pick`;
+    }
+    const ids = (Array.isArray(aliases) ? aliases : []).map((m) => String(m && m.id).trim());
+    if (ids.includes(stated.toLowerCase())) return '';
+    return (
+      `the autonomous queue's Pro class runs the subscription through the claude CLI, ` +
+      `which accepts only its own model aliases (${ids.join('/')}); "${stated}" is not one`
+    );
+  }
   // normalized === 'local'
   if (!stated) return 'a local task needs a model — the tag of whatever is pulled into the local daemon';
   return '';
@@ -594,13 +629,18 @@ function createQueueWorker({
    */
   async function runTask(item, { carry = '', commit } = {}) {
     const cwd = item.cwd || process.cwd();
-    // Aegis Cloud or nothing — checked BEFORE the turn, not at the server. An
-    // item whose model is not a pooled tier (a hand-edited queue file, a
-    // `--model` the CLI accepted before this rule existed, another host's
-    // older build) would otherwise go out as `class: 'aegis'` with an id the
-    // pool does not serve: billed work if it happens to be a per-provider
-    // spelling, an opaque server error otherwise. Failing here names the model
-    // and the allowed ones, and costs nothing.
+    // The task's own (model, class) pair checked BEFORE the turn, not at the
+    // server. An item whose model does not belong to its class (a hand-edited
+    // queue file, a `--model` the CLI accepted before this rule existed,
+    // another host's older build) would otherwise go out under a transport
+    // that does not serve it: billed work if it happens to be a per-provider
+    // spelling, an opaque server error otherwise, and for 'pro' a `claude
+    // --model` that the child rejects. Failing here names the model and the
+    // spellings that class accepts, and costs nothing.
+    //
+    // "Aegis Cloud or nothing" was this comment's old claim, and it stopped
+    // being true when byok/local were added (9eeef09) — modelRefusal is what
+    // actually enforces the rule now, per class, and it runs for all four.
     const cls = normalizeClass(item.class);
     const refusal = modelRefusal(item.model, cls);
     if (refusal) {

package/lib/local/claude-pro.js

@@ -317,11 +317,25 @@ function turnArgs(payload) {
  *     "the first collecting block" pairs a fragment with the wrong call.
  *   - one `user` line can carry a tool_result for EVERY call in a parallel
  *     round, so all of them are resolved, not just the first.
+ *
+ * `thinking_delta` is the third delta type and is NOT folded into `text`: an
+ * extended-thinking block is deliberation, not the answer, so it goes out on
+ * its own callback and its own accumulator. Dropping it entirely (which is what
+ * this parser did) left BOTH channels empty for the whole thinking phase, which
+ * is the longest stretch of a Pro turn — so the renderers' live meters, whose
+ * only literal `0` is the "nothing received yet" branch, read `↓0 tokens` for
+ * the entire time the turn was visibly working. Claude Code Pro runs extended
+ * thinking by default, so this was the normal case, not an edge.
  */
 function createStreamParser(handlers) {
   const h = handlers || {};
   const tools = new Map(); // id -> {id, index, name, args, startedAt, phase}
   let text = '';
+  let thinking = '';
+  // Thinking progress the provider MEASURED, in tokens. On a real Pro turn
+  // `thinking_delta.thinking` is the empty string and this is the only figure
+  // the frame carries — see the `thinking_delta` branch below.
+  let thinkingTokens = 0;
   let resultLine = null;
 
   const emitRun = (block) => {
@@ -366,6 +380,30 @@ function createStreamParser(handlers) {
             const t = (e.delta.text || '').replace(/\x00/g, '');
             text += t;
             if (h.onText && t) h.onText(t);
+          } else if (e.delta.type === 'thinking_delta') {
+            // Same `\x00` scrub as the visible text, for the same reason: a
+            // NUL in the frame would otherwise be handed to a terminal.
+            const t = (e.delta.thinking || '').replace(/\x00/g, '');
+            thinking += t;
+            if (h.onThinking && t) h.onThinking(t);
+            // The figure that ACTUALLY moves on a subscription turn. Measured
+            // against Claude Code 2.1.228: every real `thinking_delta` carries
+            // `thinking: ""` with the deliberation withheld (the finished
+            // block ships a 5.4 KB `signature` and no text), while
+            // `estimated_tokens` advances in increments that sum to just under
+            // the billed `usage.output_tokens_details.thinking_tokens`
+            // (measured: 1900 vs 1943, 1800 vs 1832, 250 vs 339). So the text
+            // channel is empty for the WHOLE thinking phase on a Pro turn and
+            // the earlier `onThinking`-only fix never fired — the live meter
+            // still read `↓0 tokens` while 4114 thinking tokens were billed
+            // across three captured turns. Incremental, not cumulative: the
+            // increments sum to the billed figure, so they are added as they
+            // arrive rather than treated as a running total.
+            const est = e.delta.estimated_tokens;
+            if (typeof est === 'number' && est > 0 && Number.isFinite(est)) {
+              thinkingTokens += est;
+              if (h.onThinkingProgress) h.onThinkingProgress(est);
+            }
           } else if (e.delta.type === 'input_json_delta') {
             const t = collecting(e.index == null ? 0 : e.index);
             if (t) t.args += e.delta.partial_json || '';
@@ -396,6 +434,13 @@ function createStreamParser(handlers) {
             costUsd: typeof j.total_cost_usd === 'number' ? j.total_cost_usd : undefined,
             durationMs: j.duration_ms,
             sessionId: j.session_id,
+            // The deliberation this round DID produce, handed up so the engine
+            // can tell a thinking-only round apart from a genuinely empty one.
+            // On a real Pro turn the text is normally withheld and only the
+            // billed token count is available, so `thinking` is often empty
+            // even when the child thought — hence both fields, and the count.
+            thinking: thinking || '',
+            thinkingTokens,
           });
         }
       }
@@ -404,6 +449,14 @@ function createStreamParser(handlers) {
     get text() {
       return text;
     },
+    get thinking() {
+      return thinking;
+    },
+    // Thinking tokens the PROVIDER measured, not inferred from text — the only
+    // honest way to meter a Pro turn, whose thinking text is withheld.
+    get thinkingTokens() {
+      return thinkingTokens;
+    },
     get resultLine() {
       return resultLine;
     },
@@ -454,6 +507,41 @@ function seamAvailable(dir) {
   }
 }
 
+/**
+ * The `choices[0].message` a Pro turn reports.
+ *
+ * `content` is the child's own final answer, as before. The addition is the
+ * deliberation, carried on the shape the engine already reads: `reasoning_content`
+ * is what `engine.js` `reasoningTextOf()` looks for first, so a Pro round that
+ * spent its output thinking is now visible as exactly that.
+ *
+ * This matters because of how a Pro turn fails. When extended thinking is on —
+ * which is Claude Code's default — the child can finish a round having produced
+ * deliberation and no answer, and the engine's recovery ladder decides what to
+ * do next by asking `reasonedButSilent(res)`, i.e. "was this round empty, or did
+ * it think and stay silent?". Before this field existed, a Pro result never
+ * carried reasoning at all, so that question always answered "genuinely empty"
+ * and the ladder burned its rounds on the generic nudge — the ask that invites
+ * the same silent thinking pass a second time. Worse, `emptyTurnError` reported
+ * it as "No visible text came back from any of those calls", which is the wrong
+ * diagnosis: the model was not silent, it was thinking.
+ *
+ * `thinking_tokens` rides alongside as the provider's own billed count. On a
+ * real Pro turn the deliberation TEXT is withheld — measured across three turns,
+ * every `thinking_delta` carried `thinking: ""` while thousands of tokens were
+ * billed — so a text-only signal would still miss the case this exists for. The
+ * count is the honest figure, and it is the only one that arrives.
+ */
+function proMessage(text, thinking, thinkingTokens) {
+  const msg = { content: text || '' };
+  const deliberation = typeof thinking === 'string' ? thinking : '';
+  if (deliberation) msg.reasoning_content = deliberation;
+  if (typeof thinkingTokens === 'number' && thinkingTokens > 0 && Number.isFinite(thinkingTokens)) {
+    msg.thinking_tokens = thinkingTokens;
+  }
+  return msg;
+}
+
 /**
  * Run one turn on the user's Claude Code subscription.
  *
@@ -635,6 +723,30 @@ function runClaudePro(opts, deps) {
         armIdle();
         if (o.onDelta) o.onDelta({ delta: t });
       },
+      // Extended thinking, forwarded on the SAME channel the engine's pooled
+      // brain path already uses for a worker's deliberation (`onReasoning`,
+      // engine.js — `onDelta({ reasoning })`). Both renderers already consume
+      // that field, so the live token meter counts the thinking phase on a Pro
+      // turn exactly as it does everywhere else, with no consumer-side edit.
+      // `engine.js` hands `runClaudePro` the RAW `opts.onDelta` (not the wrapped
+      // `onReasoning`), so this transport is the one that must emit the field.
+      onThinking: (t) => {
+        armIdle();
+        if (o.onDelta) o.onDelta({ reasoning: t });
+      },
+      // The channel that actually fires on a Pro turn. `onThinking` above is
+      // kept for any provider that does stream deliberation text, but Claude
+      // Code withholds it: measured across three real turns, every
+      // `thinking_delta` carried `thinking: ""`, so `onThinking` never fired
+      // once while 4114 thinking tokens were billed. This carries the
+      // provider's own MEASURED count, on a numeric channel of its own rather
+      // than the text one — the consumers turn `reasoning` text into tokens at
+      // 4 chars:1 token, so a token count sent down that path would be divided
+      // by four and read as a quarter of the truth.
+      onThinkingProgress: (est) => {
+        armIdle();
+        if (o.onDelta) o.onDelta({ thinkingTokens: est });
+      },
       onTool: (info) => {
         armIdle();
         if (!o.onDelta) return;
@@ -662,7 +774,7 @@ function runClaudePro(opts, deps) {
           return;
         }
         settle({
-          choices: [{ message: { content: r.text || '' }, finish_reason: 'stop' }],
+          choices: [{ message: proMessage(r.text || '', r.thinking, r.thinkingTokens), finish_reason: 'stop' }],
           usage: r.usage || undefined,
           costUsd: r.costUsd,
           durationMs: r.durationMs,
@@ -704,7 +816,12 @@ function runClaudePro(opts, deps) {
       // one. Anything else is a real failure and is reported as one rather than
       // as an empty successful answer.
       settle({
-        choices: [{ message: { content: parser.text }, finish_reason: 'stop' }],
+        choices: [
+          {
+            message: proMessage(parser.text, parser.thinking, parser.thinkingTokens),
+            finish_reason: 'stop',
+          },
+        ],
         usage: (parser.resultLine && parser.resultLine.usage) || undefined,
         childRecord: built.record,
         error:

package/lib/local/engine.js

@@ -743,6 +743,51 @@ function extractToolCalls(res) {
 }
 
 /** The textual content of one assistant turn (empty when it only called tools). */
+/**
+ * The prompt a Pro turn actually hands the child.
+ *
+ * `pro` is the one class that does not replay `opts.messages` into its
+ * transport: the `claude` child runs its own agent loop, so sending this
+ * engine's transcript would make it re-run every tool call a second time. That
+ * decision is right for an ordinary turn and silently wrong for the engine's
+ * RE-ASK rounds — the synthesis pass and the recovery ladder both re-dispatch
+ * with `prompt: ''` plus a grown `messages`, which is the shape every other
+ * class reads as "continue this conversation; the new instruction is the last
+ * user message in the history". The Pro branch read only `opts.prompt`, so each
+ * of those rounds spawned `claude -p ''`: an empty prompt, on a child whose
+ * stdin is `'ignore'`, with `--resume` as its only other context.
+ *
+ * The consequence was the failure this function exists to prevent. A Pro turn
+ * whose first round came back empty could never be recovered, because every
+ * recovery round was guaranteed empty too — the ladder then reported "2 extra
+ * recovery calls with a larger budget and a changed ask came back empty too"
+ * over a transport that had been asked nothing at all. Measured on
+ * claude-code-pro, 2026-10-11.
+ *
+ * So when a round carries no prompt of its own, the LAST user message in
+ * `opts.messages` becomes the child's prompt. The nudges the ladder appends are
+ * exactly that, and `--resume` reattaches the child to its own session, so the
+ * instruction lands in a conversation that already holds the findings — which
+ * is what makes the recovery round a re-ask rather than a fresh, empty one.
+ *
+ * An ordinary turn is untouched: it has its own prompt, so the first branch
+ * returns before `messages` is ever consulted.
+ */
+function proTurnPrompt(opts) {
+  const own = typeof opts.prompt === 'string' ? opts.prompt.trim() : '';
+  if (own) return opts.prompt;
+  const messages = Array.isArray(opts.messages) ? opts.messages : [];
+  for (let i = messages.length - 1; i >= 0; i -= 1) {
+    const m = messages[i];
+    if (!m || m.role !== 'user') continue;
+    if (typeof m.content === 'string' && m.content.trim()) return m.content;
+  }
+  // Nothing to borrow: keep the caller's own value rather than inventing text,
+  // so a round with genuinely no ask still reaches the ladder and is reported
+  // as the empty round it is.
+  return opts.prompt;
+}
+
 function assistantText(res) {
   const msg = res && res.choices && res.choices[0] && res.choices[0].message;
   return (msg && typeof msg.content === 'string' && msg.content) || '';
@@ -808,6 +853,42 @@ function reasoningTextOf(res) {
   return '';
 }
 
+/**
+ * Deliberation the provider MEASURED but withheld, in tokens.
+ *
+ * The companion to `reasoningTextOf()` above, for the one case where there is no
+ * text to read: Claude Code Pro runs extended thinking by default and withholds
+ * the deliberation itself, so `thinking_delta.thinking` arrives as the empty
+ * string while the billed count climbs. A round like that carries real reasoning
+ * and no reasoning TEXT, so a text-only predicate reads it as "the model said
+ * nothing" — the wrong diagnosis, and the one that made a Pro turn report
+ * "No visible text came back" while the child had in fact been thinking.
+ *
+ * Read from the message shape first (what `claude-pro.js` `proMessage()` sets)
+ * and then from the standard usage detail `completion_tokens_details.
+ * reasoning_tokens`, so a provider that meters deliberation on the usage
+ * envelope is seen too.
+ */
+function reasoningTokensOf(res) {
+  if (!res) return 0;
+  const choice = res.choices && res.choices[0];
+  const msg = (choice && choice.message) || {};
+  const usage = res.usage || {};
+  const details = usage.completion_tokens_details || usage.output_tokens_details || {};
+  const candidates = [
+    msg.thinking_tokens,
+    msg.reasoning_tokens,
+    choice && choice.thinking_tokens,
+    res.thinking_tokens,
+    details.reasoning_tokens,
+    details.thinking_tokens,
+  ];
+  for (const c of candidates) {
+    if (typeof c === 'number' && Number.isFinite(c) && c > 0) return c;
+  }
+  return 0;
+}
+
 /**
  * The empty turn `isTruncated()` cannot see, and the reason this error survived
  * a truncation retry that was already in place: a reasoning model that spends
@@ -818,9 +899,14 @@ function reasoningTextOf(res) {
  * `reasoning_content`, which fell straight through both retry gates to
  * emptyTurnError. Reasoning tokens and answer tokens share one budget, so the
  * recovery is identical to a 'length' cut: buy room and ask once more.
+ *
+ * A round with no reasoning TEXT but a non-zero reasoning-token count counts as
+ * reasoning here: that is a Pro turn whose deliberation was withheld, and
+ * treating it as genuinely empty is what sent it to the generic nudge instead
+ * of the ask that names the problem.
  */
 function reasonedButSilent(res) {
-  return !assistantText(res) && reasoningTextOf(res) !== '';
+  return !assistantText(res) && (reasoningTextOf(res) !== '' || reasoningTokensOf(res) > 0);
 }
 
 /**
@@ -979,8 +1065,20 @@ const RECOVERY_ROUNDS = 2;
  * real tool log on screen, keeps the transcript honest, and names the cause
  * (renderer prints `Error: <message>`).
  */
-function emptyTurnError({ cls, model, finishReason, reasoningChars, effort, recoveryRounds }) {
+function emptyTurnError({ cls, model, finishReason, reasoningChars, reasoningTokens, effort, recoveryRounds }) {
   const calls = Number(recoveryRounds) || 0;
+  // A withheld deliberation has no chars to count, so the two signals are
+  // reported as the one fact they both are: the round spent its output on
+  // thinking. Without this the Pro case printed "No visible text came back from
+  // any of those calls", which describes a transport that produced nothing —
+  // the opposite of a child that reasoned at length and wrote no answer.
+  const tokens = Number(reasoningTokens) || 0;
+  const reasoned = !!reasoningChars || tokens > 0;
+  const reasonClause = reasoningChars
+    ? `, hidden reasoning: ${reasoningChars} chars and no visible text`
+    : tokens > 0
+      ? `, ~${tokens} thinking tokens billed and no visible text`
+      : '';
   const err = new Error(
     `The model returned no answer after ${cls}/${model} was asked to summarise its results` +
       (calls
@@ -989,8 +1087,8 @@ function emptyTurnError({ cls, model, finishReason, reasoningChars, effort, reco
         : '') +
       ` (stop reason: ${finishReason || 'none'}` +
       `${effort ? `, effort: ${effort}` : ''}` +
-      `${reasoningChars ? `, hidden reasoning: ${reasoningChars} chars and no visible text` : ''}). ` +
-      (reasoningChars
+      `${reasonClause}). ` +
+      (reasoned
         ? // Deliberately NOT "raise the Effort rung". The budget was already taken
           // out of the equation before this error could be reached: the recovery
           // calls above ran at the top of the ladder, so pointing at the ceiling
@@ -1878,6 +1976,12 @@ function createLocalEngine({
           provider,
           model: bareModel,
           providerKey: opts.apiKey,
+          // Only meaningful for provider "custom" (aegis1 reads it ONLY on
+          // that id) — forwarded unconditionally anyway, same as the other
+          // fields above, rather than special-cased per provider here.
+          // `cfg` is this provider's settings row (byokNamespace(provider)),
+          // the same row /byok-key and /model-add write.
+          baseURL: opts.cfg && opts.cfg.baseURL,
           prompt: opts.prompt,
           system: opts.system,
           messages: opts.messages,
@@ -2017,7 +2121,10 @@ function createLocalEngine({
       // (one/src/child.js), so this host and AEGISONE's faces cannot disagree
       // about what the child was allowed to do.
       const proRes = await claudePro.runClaudePro({
-        prompt: opts.prompt,
+        // The re-ask round's instruction, when this round has none of its own.
+        // See proTurnPrompt(): without it every recovery round spawned the
+        // child with an empty prompt and the turn could never be recovered.
+        prompt: proTurnPrompt(opts),
         model: opts.model && opts.model !== 'default' ? opts.model : undefined,
         system: opts.system,
         cwd: opts.cwd,
@@ -2771,6 +2878,10 @@ function createLocalEngine({
               recoveryRounds,
               finishReason: finishReasonOf(res),
               reasoningChars: reasoningTextOf(res).length,
+              // The withheld-deliberation case (a Pro turn with extended
+              // thinking on): no chars to count, but the provider billed the
+              // thinking. Without this the report claims nothing came back.
+              reasoningTokens: reasoningTokensOf(res),
             });
           }
           return withTurnUsage(res);

package/lib/provider-key-mirror.js

@@ -97,6 +97,119 @@ function mirrorProviderKeyToEnvFile(envFile, provider, key, opts = {}) {
   }
 }
 
+/**
+ * Copy every provider key the store already holds into the shared env file.
+ *
+ * `wrapProviderKeyMirror` above is a WRITE-TIME hook: it mirrors a key at the
+ * moment it is saved. That leaves a real gap the hook cannot close, because a
+ * key saved before the hook existed never fires it — an install whose provider
+ * row predates this module (or any row written while the wrapper was not
+ * installed, e.g. a direct settings write from a test or a repair script) keeps
+ * its key in the encrypted store alone, and the CLI never sees it. A stored key
+ * is not a mirrored key; only a fresh Save used to make them the same thing.
+ *
+ * The same gap swallows a "blank = keep" save: `renderer/app.js` saves a
+ * provider row with `key` undefined when the key field is left empty (that
+ * means "keep the stored one" — see the wrapper's comment), so the wrapper
+ * correctly mirrors nothing and the row's real key stays host-local for ever.
+ *
+ * So this runs ONCE at start-up and reconciles the two stores by reading, not
+ * by writing: for every non-reserved row that HAS a stored key whose variable
+ * the shared file does not already carry, write it. It is:
+ *
+ *   - idempotent — a second call on an already-synced machine mirrors nothing
+ *     (the `keyStatus(...).inFile` check is the guard), and it never rewrites a
+ *     variable that is already present, so a hand-edited `.env` keeps its own
+ *     spelling, comments and line order;
+ *   - one-directional — store -> file only. The file is never read back into
+ *     the encrypted store, so this cannot become a merge loop or overwrite a
+ *     newer key the CLI wrote (which the desktop would then be second-guessing);
+ *   - non-fatal — a row that cannot be decrypted or written is REPORTED and
+ *     skipped. A start-up reconcile must never keep the window from opening.
+ *
+ * Must run after app 'ready': `safeStorage` (which decrypts the stored key) is
+ * not usable before then.
+ *
+ * @param {object} store    a settings store (needs `list`, and `rawKey` for the
+ *                          decrypted value — the exact pair settings.js exposes)
+ * @param {object} envFile  client/env-file.js
+ * @param {object} [opts]   `onWarn`, `envOpts` (see above)
+ * @returns {{mirrored:string[], skipped:string[], failed:string[]}} what
+ *          happened per provider, so a caller/test can assert rather than guess
+ */
+function backfillProviderKeys(store, envFile, opts = {}) {
+  const warn = typeof opts.onWarn === 'function' ? opts.onWarn : () => {};
+  const envOpts = opts.envOpts || {};
+  const out = { mirrored: [], skipped: [], failed: [] };
+  if (!store || typeof store.list !== 'function') return out;
+  if (!envFile || typeof envFile.envVarFor !== 'function') return out;
+
+  let rows = [];
+  try {
+    rows = store.list() || [];
+  } catch (e) {
+    warn(`could not read the provider store to backfill the shared env file: ${e && e.message}`);
+    return out;
+  }
+
+  for (const row of rows) {
+    const provider = row && row.provider;
+    // Same filters as the write-time mirror: a reserved row is the store's own
+    // bookkeeping, and an unmappable name is a name we do not invent.
+    if (typeof provider !== 'string' || !provider) continue;
+    if (provider.startsWith(RESERVED_PREFIX)) continue;
+
+    const name = envFile.envVarFor(provider);
+    if (!name || !KEY_VAR_SUFFIX.test(name)) {
+      out.skipped.push(provider);
+      continue;
+    }
+    // A name the env file itself refuses (a production secret, not a host key)
+    // is not a failure to report — `setEnvValue` would reject it by design.
+    if (typeof envFile.isForeignSecret === 'function' && envFile.isForeignSecret(name)) {
+      out.skipped.push(provider);
+      continue;
+    }
+
+    // Already shared? Then there is nothing to do, and — importantly — nothing
+    // to overwrite. This is the idempotence guard.
+    let status = null;
+    try {
+      status = typeof envFile.keyStatus === 'function' ? envFile.keyStatus(name, envOpts) : null;
+    } catch { /* unreadable file is "not in the file"; the write below reports it */ }
+    if (status && status.inFile) {
+      out.skipped.push(provider);
+      continue;
+    }
+
+    // `row.configured` is the store's own "a key is stored" flag (settings.js
+    // get() derives it from the decrypted value), so a base-URL-only row is
+    // skipped here rather than being asked for a key it never had.
+    if (row.configured === false) {
+      out.skipped.push(provider);
+      continue;
+    }
+
+    let key = '';
+    try {
+      key = typeof store.rawKey === 'function' ? store.rawKey(provider) : '';
+    } catch (e) {
+      warn(`could not decrypt ${provider}'s stored key for the shared env file: ${e && e.message}`);
+      out.failed.push(provider);
+      continue;
+    }
+    if (!key) {
+      out.skipped.push(provider);
+      continue;
+    }
+
+    const res = mirrorProviderKeyToEnvFile(envFile, provider, key, opts);
+    if (res && res.ok) out.mirrored.push(provider);
+    else out.failed.push(provider);
+  }
+  return out;
+}
+
 /**
  * Wrap a provider-settings store so every key saved or removed through it is
  * also written to the shared env file.
@@ -138,4 +251,4 @@ function wrapProviderKeyMirror(store, envFile, opts = {}) {
   return store;
 }
 
-module.exports = { mirrorProviderKeyToEnvFile, wrapProviderKeyMirror };
+module.exports = { mirrorProviderKeyToEnvFile, wrapProviderKeyMirror, backfillProviderKeys };

package/main.js

@@ -220,6 +220,29 @@ const QUICK_PREFIX = 'quick:';
 const QUEUE_PREFIX = 'queue:';
 const AUTO_PREFIX = 'auto:';
 
+/**
+ * The model classes THIS face offers in its pickers, in registry order.
+ *
+ * Narrower than the engine's `CLASSES` registry on purpose. The engine is
+ * shared with the CLI (`cli/src/deps.js` requires this same file), so a class
+ * is added or removed once, in `engine.js`, for both hosts — and the CLI does
+ * ship `pro` (the user's own Claude Code subscription, spawned through the
+ * `claude` binary). This face does not: the Pro transport hands the turn to a
+ * headless child that runs its own agent loop and its own permission prompts,
+ * and this window has no channel to answer those prompts, so selecting it here
+ * is a class a user can pick and then watch do nothing. Omitted rather than
+ * listed-and-broken.
+ *
+ * Filtering HERE rather than in the registry is the same move the CLI makes in
+ * `cli/src/engine.js` (`listClasses().filter((c) => HOST_CLASSES.includes(…))`):
+ * the registry stays the single source of truth for every class that EXISTS,
+ * and each host names the subset it offers. Removing this filter, or adding a
+ * class here that `engine.listClasses()` does not return, is a one-line change
+ * on this line — and the picker is built from this function's output, so a class
+ * absent here is one no user can select, which is the whole point.
+ */
+const DESKTOP_CLASSES = Object.freeze(['aegis', 'byok', 'local']);
+
 /**
  * Main -> renderer push channel for chat SSE deltas (D2.1 streaming render).
  * The invoke of aegis:chatCompletion still resolves once with the normalised
@@ -1579,7 +1602,10 @@ function createModelDispatch(engine, { env = process.env, settings } = {}) {
   };
 
   const dispatch = {
-    listClasses: () => engine.listClasses(),
+    // The picker's source. Filtered through DESKTOP_CLASSES so this face never
+    // offers a class it cannot serve; see that constant for why `pro` is
+    // omitted here while the engine still ships it for the CLI.
+    listClasses: async () => (await engine.listClasses()).filter((c) => DESKTOP_CLASSES.includes(c.class)),
     listModels: (payload) => engine.listModels(payload && payload.class),
     chat: chatWithAutoRounds,
     // The AEGIS key lives in a reserved namespace the store refuses to expose
@@ -3984,6 +4010,36 @@ function bootstrap() {
     } catch (err) {
       console.warn('presence: beacon not started', err && err.message);
     }
+    // One-way backfill of the cross-host key mirror. wrapProviderKeyMirror
+    // (above) is a WRITE-TIME hook: it only fires when a key is saved through
+    // this store, so every row that predates the hook — or was saved with the
+    // key field left blank ("keep the stored one", which mirrors nothing by
+    // design) — still lives only in this app's encrypted store and is invisible
+    // to the CLI and the MCP plugin. Running the reconcile here closes that gap
+    // once per launch, in the store -> file direction only, and skips any
+    // variable the shared file already carries. After app 'ready', because
+    // safeStorage (which decrypts the stored key) is unusable before then, and
+    // deliberately before createWindow() so the CLI's next run — not the next
+    // Save — is when the key becomes visible.
+    //
+    // Never fatal: the keys are already saved, and a failed copy to the shared
+    // file is a smaller problem than a window that does not open.
+    try {
+      const { backfillProviderKeys } = require('./lib/provider-key-mirror.js');
+      const onWarn = (m) => console.warn(`aegis: ${m}`);
+      const result = backfillProviderKeys(settings, envFile, { onWarn });
+      if (result.mirrored.length) {
+        console.warn(
+          `aegis: shared ${result.mirrored.join(', ')} key(s) with the other hosts `
+            + `(${envFile.envFileFor()})`
+        );
+      }
+      if (engine && engine.settings && engine.settings !== settings) {
+        backfillProviderKeys(engine.settings, envFile, { onWarn });
+      }
+    } catch (e) {
+      console.warn(`aegis: could not backfill the shared env-file key mirror: ${e && e.message}`);
+    }
     // Apply whatever was last saved (or the default): ship the shortcut only
     // when app.isPackaged || the settings flag is on — see
     // shouldEnableGlobalShortcut — so a plain `electron .` dev run never
@@ -4054,6 +4110,7 @@ module.exports = {
   taggedChunk,
   maskKey,
   createModelDispatch,
+  DESKTOP_CLASSES,
   readTextFileForPreview,
   PREVIEW_READ_MAX_BYTES,
   createSyncDispatch,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "aegis-desktop",
   "productName": "AEGIS Desktop",
-  "version": "1.0.8",
+  "version": "1.0.10",
   "description": "Thin Electron host for AEGIS — a local chat UI over the shared client/aegis.js transport. Ships transport + UI only; engine logic stays server-side.",
   "author": {
     "name": "AEGIS Code",
@@ -58,14 +58,17 @@
     "test:renderer-fonts": "node test/renderer-fonts.test.mjs",
     "test:account-key": "node test/account-key.test.mjs"
   },
+  "engines": {
+    "node": ">=22.0.0"
+  },
   "dependencies": {
     "electron-updater": "^6.8.9"
   },
   "devDependencies": {
-    "electron-builder": "^25.1.8",
-    "electron": "^33.0.0"
+    "electron-builder": "^26.15.3",
+    "electron": "^44.0.0"
   },
   "optionalDependencies": {
-    "electron": "^33.0.0"
+    "electron": "^44.0.0"
   }
 }

package/renderer/app.js

@@ -572,6 +572,11 @@ function renderRollMeter(sessionId, live) {
       // model the meter sat on one number for the whole (longest, priciest)
       // phase of the turn and looked dead while the AI was demonstrably working.
       reasoning: live.reasoning,
+      // …and the provider-measured thinking tokens, which on a subscription
+      // turn are the whole of the deliberation (its text is withheld). The
+      // preview must carry the same quantity the bubble's own figure shows, or
+      // the two live meters disagree — which this file forbids.
+      measuredReasoningTokens: live.measuredReasoningTokens,
     });
   }
   const line = roll ? fmtRoll(roll) : '';
@@ -611,6 +616,15 @@ function renderRollMeter(sessionId, live) {
 function liveTokenFig(live) {
   const reply = typeof live.reply === 'string' ? live.reply : '';
   const reasoning = typeof live.reasoning === 'string' ? live.reasoning : '';
+  // Thinking tokens the PROVIDER measured — the only live signal on a
+  // subscription turn, which withholds the deliberation text entirely (every
+  // real `thinking_delta` carries `thinking: ""` while `estimated_tokens`
+  // advances). Part of the billed output, so it belongs in this figure exactly
+  // as the `reasoning` text does, and it is already a token count.
+  const measured =
+    typeof live.measuredReasoningTokens === 'number' && live.measuredReasoningTokens > 0
+      ? live.measuredReasoningTokens
+      : 0;
   // A turn in flight that has produced nothing YET. Its figure is zero, and
   // zero is what the other measured surface shows at this moment: the CLI's
   // spinner tail counts the answer's deltas and the thinking trace's, so it too
@@ -632,7 +646,12 @@ function liveTokenFig(live) {
   // a threshold. Safe because the caller only passes `live` for a turn still
   // running: this is a statement about that turn, not a fabricated measurement
   // of a finished one.
-  if (!reply && !reasoning) return '↓0 tokens';
+  // The measured thinking count alone is enough to have a figure. Without this
+  // term a subscription turn — empty `reply`, empty `reasoning` text, but
+  // thousands of billed thinking tokens — took the `↓0 tokens` branch below for
+  // its whole thinking phase, which is the bug this function's `measured`
+  // addend exists to close.
+  if (!reply && !reasoning && !measured) return '↓0 tokens';
   let output = 0;
   try {
     const est = estimatedBuckets(live.prompt, reply, reasoning);
@@ -660,8 +679,19 @@ function liveTokenFig(live) {
     }
     output = Math.ceil(cells / 4);
   }
+  // Summed, not substituted: `measured` is the provider's count of deliberation
+  // that never entered `reply`/`reasoning` as text, so the two are disjoint and
+  // both are billed output. Adding it here is also what keeps the figure moving
+  // through the thinking phase and then continuing to climb as the answer
+  // streams, rather than dropping back to the answer-only estimate.
+  output += measured;
   if (!output) return '';
-  return `↓${Math.round(output)} tokens`;
+  // `measured` is Anthropic's own `estimated_tokens` running count, which the
+  // stream parser's own measurements show landing under the real billed
+  // thinking-token figure (1900 vs 1943, 1800 vs 1832, 250 vs 339) — so once
+  // it has contributed, the figure is a floor, not the true count, until the
+  // turn's real `usage` lands.
+  return `↓${measured > 0 ? '≥' : ''}${Math.round(output)} tokens`;
 }
 
 /**
@@ -4984,6 +5014,10 @@ async function send() {
 
   let streamedText = '';
   let reasoningText = '';
+  // Thinking tokens the provider MEASURED (subscription turns report progress
+  // in these while withholding the text). Added verbatim to the live figure,
+  // never divided by 4 the way the text channels are.
+  let measuredReasoningTokens = 0;
   const toolLog = [];
   // How much of the stream the live meter last measured. Per-turn by
   // construction (declared here, not at module scope), so a new turn starts its
@@ -5019,14 +5053,39 @@ async function send() {
     // stream and this runs inside the painter: ungated it is linear per frame,
     // i.e. quadratic over the turn, on the thread the reader is scrolling.
     const streamChars = streamedText.length + reasoningText.length;
-    if (liveMeterDue(meterChars, streamChars)) {
-      meterChars = streamChars;
-      renderRollMeter(sessionId, { prompt, reply: streamedText, reasoning: reasoningText });
+    // The provider's thinking tokens are progress too, and on a subscription
+    // turn they are the ONLY progress: no text arrives at all during the
+    // thinking phase, so a char-only gate saw `grown <= 0` and refused to
+    // repaint, leaving the bubble frozen on `↓0 tokens` however many tokens were
+    // billed. Counted at the same 4 chars:1 token ratio the other live surfaces
+    // use, purely so this gate sees growth; the figure itself is rendered from
+    // the token count, never this char-equivalent.
+    const progress = streamChars + measuredReasoningTokens * 4;
+    if (liveMeterDue(meterChars, progress)) {
+      meterChars = progress;
+      renderRollMeter(sessionId, {
+        prompt,
+        reply: streamedText,
+        reasoning: reasoningText,
+        measuredReasoningTokens,
+      });
     }
     stickToBottom();
   });
 
   const onDelta = (chunk) => {
+    // Provider-MEASURED thinking progress, in tokens. On a subscription turn
+    // the deliberation text is withheld (`thinking_delta.thinking` is the empty
+    // string), so the `reasoning` text branch below never fires and the live
+    // meter sat on `↓0 tokens` through the whole thinking phase — the longest,
+    // priciest part of the turn — while thousands of thinking tokens were
+    // billed. Already a token count, so it is added rather than divided by 4
+    // like the text channels.
+    if (chunk && typeof chunk.thinkingTokens === 'number' && chunk.thinkingTokens > 0) {
+      measuredReasoningTokens += chunk.thinkingTokens;
+      paintStream();
+      return;
+    }
     // Extended-reasoning trace from a pooled brain turn: the fan-out's worker
     // findings, streamed before the synthesis pass writes the answer. Shown so
     // "work autonomously" doesn't look idle for the whole worker phase.

package/renderer/index.html

@@ -565,13 +565,7 @@
                 <button type="button" class="wc-link" id="welcome-byok">
                   Bring your own key →
                 </button>
-                <span class="wc-note" id="welcome-byok-note">
-                  The free path, and it stays free: exec, write and edit run on
-                  your machine, your repos, sessions and keys live on this disk,
-                  and a local model server needs no account at all. A provider
-                  key relayed through AEGIS is still a cloud turn, so it bills a
-                  small handling fee — nothing that runs on this machine does.
-                </span>
+                <span class="wc-note" id="welcome-byok-note"></span>
                 <button type="button" class="wc-skip" id="welcome-dismiss">
                   Don't show this again
                 </button>

package/renderer/usage.js

@@ -828,16 +828,35 @@ function rollTurn(roll, usage, opts = {}) {
     // number, and what stops the total standing still on exactly the turns the
     // pool declined to report on — the symptom this fallback exists to remove.
     const est = estimatedBuckets(opts.prompt, opts.reply, opts.reasoning);
+    // Thinking tokens the provider MEASURED, not estimated. On a subscription
+    // turn the deliberation text is withheld entirely (every real
+    // `thinking_delta` carries `thinking: ""`), so `estimatedBuckets` above
+    // cannot see the longest, priciest part of the turn and the live preview
+    // read 0 for the whole thinking phase. Added verbatim — it is already a
+    // token count, and it is billed output exactly as the reply is.
+    const measured =
+      typeof opts.measuredReasoningTokens === 'number' && opts.measuredReasoningTokens > 0
+        ? opts.measuredReasoningTokens
+        : 0;
     if (!est) {
-      // Nothing reported AND no text to estimate from. The single case that
-      // stays uncounted: `unknown` names the gap, where a fabricated zero would
-      // read as a measurement.
-      next.unknown += 1;
+      // A subscription turn with nothing written yet but thinking under way is
+      // NOT the `unknown` case: the provider measured it, so a zero would be a
+      // fabricated reading rather than an absent one.
+      if (!measured) {
+        // Nothing reported AND no text to estimate from. The single case that
+        // stays uncounted: `unknown` names the gap, where a fabricated zero
+        // would read as a measurement.
+        next.unknown += 1;
+        return next;
+      }
+      next.tokens += measured;
+      next.output += measured;
+      next.estimated += 1;
       return next;
     }
-    next.tokens += est.input + est.output;
+    next.tokens += est.input + est.output + measured;
     next.input += est.input;
-    next.output += est.output;
+    next.output += est.output + measured;
     next.estimated += 1;
     return next;
   }

package/vendor/aegis.js

@@ -1133,6 +1133,7 @@ function createClient(opts = {}) {
     onStream,
     signal,
     providerKey,
+    baseURL,
   } = {}) {
     const key = providerKey !== undefined ? providerKey : opts.providerKey;
     // Same rule as the pooled path above: omit `max_tokens` entirely when the
@@ -1169,6 +1170,11 @@ function createClient(opts = {}) {
       // `tools: []` differently from the field's plain absence.
       ...(Array.isArray(tools) && tools.length ? { tools } : {}),
       ...(toolChoice ? { tool_choice: toolChoice } : {}),
+      // Read server-side ONLY for provider "custom" (aegis1 app.py
+      // byok_chat_completions) — every other provider's upstream host is a
+      // constant the server already knows, so sending this for them is a
+      // no-op rather than a behaviour change.
+      ...(baseURL ? { base_url: baseURL } : {}),
     };
     if (model) body.model = model;
     const headers = {

package/vendor/user-models.js

@@ -27,7 +27,7 @@
  *
  * ── what a user does now ───────────────────────────────────────────────────
  *
- *   CLI       `/model-add <provider> <model-id>`   (and `/model-rm …`)
+ *   CLI       `/model-add <provider> [api-key] <model-id>`   (and `/model-rm …`)
  *   Desktop   Settings → "Add a model" → provider + id
  *   Either    hand-edit `$AEGISCODE_HOME/models.json` (default `~/.aegiscode`)
  *